Packagist ec-cube/ec-cube

Name: Packagist ec-cube/ec-cube
Brand: Packagist

productUS

pkg:composer/ec-cube/ec-cube

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical2high11medium1low

updated 2026-10-28

vulnerabilities (14)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-20717US	medium6.1	2.31% (83rd)	Exploit	no fix	2021-05-10	4.0.0 → 4.0.5
CVE-2014-0808US	medium5.0	2.25% (83rd)	—	2.12.2	2014-01-22	2.11.0 → 2.12.2
CVE-2020-5590US	high8.1	2.06% (81st)	—	4.0.4	2020-06-19	2 versions
CVE-2011-0451US	medium4.3	1.94% (80th)	—	2.4.4	2011-02-03	< 2.4.4
CVE-2021-20750US	medium6.1	1.56% (75th)	—	4.0.6	2021-06-28	2 versions
CVE-2020-5680US	high7.5	1.38% (72nd)	—	no fix	2020-12-03	3.0.5 → 3.0.18
CVE-2021-20841US	medium6.5OT elevated	1.32% (71st)	—	2.17.2	2021-11-24	2.11.2 → 2.17.2
CVE-2018-16191US	medium6.1	1.30% (70th)	—	3.0.17	2019-01-09	3.0.0 → 3.0.17
CVE-2022-40199US	low2.7	1.19% (68th)	—	no fix	2022-09-27	2 versions
CVE-2022-25355US	medium5.3OT elevated	1.16% (67th)	—	4.1.2	2022-02-24	2 versions
CVE-2021-20751US	medium6.1	1.09% (65th)	—	4.0.6	2021-06-28	4.0.0 → 4.0.6
CVE-2022-38975US	medium5.4	0.66% (52nd)	—	no fix	2022-09-27	4.0.0 → 4.1.2
CVE-2020-5679US	medium6.1	0.66% (51st)	—	no fix	2020-12-03	3.0.0 → 3.0.18
CVE-2021-20842US	medium6.5	0.55% (46th)	—	2.17.2	2021-11-24	2.11.0 → 2.17.2

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-566Authorization Bypass Through User-Controlled SQL Primary Key1 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')1 CVEs
CWE-639Authorization Bypass Through User-Controlled Key1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.